Sophos RAPIL: A slap in the face for hackers and virus writers

About Sophos RAPIL: A slap in the face for hackers and virus writers

Sophos RAPIL (Recognition and Analysis of Potentially Intruding Lifeforms) produces a real-time forensic analysis of a PC or Mac user's facial features to determine if they exhibit any characteristics commonly associated with hackers.

Learn more about RAPIL in the video we've posted at www.youtube.com/SophosLabs

The new system uses webcams, now in widespread use on modern computers, to assess the facial characteristics of computer users, and cross-references them against features typically found in cybercriminals. Current tests show that with a clear background and provided the face is free of any obstructions, including hats, moustaches and sunglasses, RAPIL has a success rate of 97.78 percent.

RAPIL samples the signal from the webcam 32 times a second. Using various new and existing machine learning techniques, such as K-Means clustering, SVM classifiers, decision trees, cross validation and genetic programming, thousands of facial characteristics including retinal patterns, shape of the philtrum, symmetry of the lips, size of the forehead and facial expression are tested to establish the probability of the user being a hacker. Once identified as a cybercriminal, the PC screen automatically goes blank, the keyboard freezes and the first 512 GB of the hard drive is encrypted with a user-defined key - many hard drives will therefore be encrypted in their entirety. The solution is fully protected against rootkits which hackers may attempt to use to disable it.

At present, advanced evasion techniques such as facial polymorphism and metamorphism can be used by hackers to evade the system. The face is polymorphic if it is randomly obstructed by an item such as hat, moustaches and glasses. Facial metamorphism, which occurs when the user changes their facial characteristics for every command run on the system, is even more difficult to detect.

As part of the beta testing for RAPIL v0.401, Sophos is appealing for computer users to upload polymorphic pictures of themselves to this Flickr group to help improve the accuracy of RAPIL still further.

Learn more about Sophos's new technology which can stop malware being written in the first place at www.sophos.com/security/blog/2008/04/1246.html

http://www.sophos.com